fix(tests): isolate test secret store paths to prevent shared /tmp/server.env

test_secret_store_path() placed secrets directly in /tmp/, meaning all
tests shared /tmp/server.env. Under parallel nextest, tests that needed
SESSION_SECRET would race on this file, and tests that didn't provide one
(auth_login_github_redirects_to_github) would accidentally inherit it
from another test.

Fix: each test now gets its own temp directory via a ULID-keyed subdirectory.
Also fix the github redirect test to explicitly provide its session key.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/crates/fabro-server/src/server.rs

@@ -2312,7 +2312,9 @@ pub(crate) fn build_app_state_with_path(
 }
 
 fn test_secret_store_path() -> PathBuf {
-    std::env::temp_dir().join(format!("fabro-test-secrets-{}.json", Ulid::new()))
+    let dir = std::env::temp_dir().join(format!("fabro-test-{}", Ulid::new()));
+    std::fs::create_dir_all(&dir).expect("test temp dir should be creatable");
+    dir.join("secrets.json")
 }
 
 fn board_column(status: RunStatus) -> Option<&'static str> {
@@ -6852,7 +6854,11 @@ slug = "fabro"
         )
         .expect("fixture should parse");
         let app = build_router(
-            create_app_state_with_options(settings, 5),
+            create_test_app_state_with_session_key(
+                settings,
+                Some("github-redirect-test-key-0123456789"),
+                false,
+            ),
             AuthMode::Enabled(ConfiguredAuth {
                 methods:   vec![ServerAuthMethod::Github],
                 dev_token: None,